Can I get the fully qualified file name of a process for which I do not have permissions?

When new updates are available, my Delphi application counts processes running from the same directory. If it finds only the current process, it downloads updates and restarts itself.

To count processes by the full file name, I use OpenProcessand GetModuleFileNameEx, as shown in this question .

In most cases, everything works, but one of my clients uses thin clients and a server on which the application is installed in several directories (each user has his own installation folder on the server).

When a user starts the application from his thin client, the application also finds processes belonging to other users, but cannot get the full name of the executable file, as it OpenProcesscauses access denial :

ERROR_ACCESS_DENIED

5 (0x5)

Access is denied.

This is how I call OpenProcessand GetModuleFileNameEx:

const
  S_PROCESS_QUERY_LIMITED_INFORMATION = $1000;

function GetFullFileNameFromPID(const PID: Cardinal) : string;
var
  ProcessHandle : THandle;
  Path : array[0..MAX_PATH - 1] of Char;
begin
  ProcessHandle := OpenProcess(S_PROCESS_QUERY_LIMITED_INFORMATION, False, PID);
  if(ProcessHandle <> 0) then
  begin
    if(GetModuleFileNameEx(ProcessHandle, 0, Result, MAX_PATH) = 0)
    then RaiseLastOSError
    else Result := Path;

    CloseHandle(ProcessHandle);
  end else
    RaiseLastOSError;
end;

Is there a way to get this information from a process for which the application does not have permissions?


Update:

The file name is not enough for my purpose, I noticed that I can get the full file name using the task manager with the same user who gets ERROR_ACCESS_DENIED, but I don’t understand how he gets this information.

enter image description here

+4
source share

Source: https://habr.com/ru/post/1660926/


All Articles